# Ciso checklist Date: 2017-11-24 # So,You want your company to be safe I've collect some sans recommendation to a list. !!!! Disclaimer - any list is no alternative to auditing and fixing the list to yourself !!!! # Leadership Skills * Business Strategy * Industry Knowledge * Business Acumen * Communication Skills * Presentation Skills * Strategic Planning * Technical Leadership * Security Consulting * Stakeholder Management * Negotiations * Mission and Vision * Values and Culture * Roadmap Development * Business Case Development * Project Management * Employee Development * Financial Planning * Budgeting * Innovation * Marketing * Leading Change * Customer Relationships * Team Building * Mentoring # Business Enablement * Product Security * Secure DevOps * Secure Development Lifecycle * Bug Bounties * Web, Mobile, Cloud AppSec * Cloud Computing * Cloud Security Architecture * Cloud Guidelines * Mobile * Bring Your Own Device (BYOD) * Mobile Policy * Emerging Technologies * Internet of Things (IoT) * Augmented Reality (AR) * Virtual Reality (VR) * Mergers and Acquisitions * Security Due Diligence # Risk Management * Risk Management Frameworks * Risk Assessment Methodology * Business Impact Analysis * Risk Assessment Process * Risk Analysis and Quantification * Security Awareness * Vulnerability Management * Vendor Risk Management * Physical Security * Disaster Recovery (DR) * Business Continuity Planning * Policies and Procedures * Risk Treatment * Mitigation Planning, Verification * Remediation, Cyber Insurance # Identity and Access Management * Provisioning/Deprovisioning * Single Sign On (SSO) * Federated Single Sign On (FSSO) * Multi-Factor Authentication * Role-Based Access Control (RBAC) * Identity Store (LDAP, ActiveDirectory) * Security Operations # Security Operations * Prevention * Data Protection * Encryption, PKI, TLS * Data Loss Prevention (DLP) * Email Security * Network Security * Firewall, IDS/IPS, Proxy Filtering * VPN, Security Gateway * DDoS Protection * Application Security * Threat Modeling * Design Review * Secure Coding * Static Analysis * Web App Scanning * WAF, RASP * Endpoint Security * Antivirus, Anti-malware * HIDS/HIPS, FIM * App Whitelisting * Secure Configurations * Active Defense * Patching * Detection * Log Management/SIEM * Continuous Monitoring * Network Security Monitoring * NetFlow Analysis * Advanced Analytics * Threat Hunting * Penetration Testing * Red Team * Vulnerability Scanning * Human Sensor * Data Loss Prevention (DLP) * Security Operations Center (SOC) * Threat Intelligence * Threat Information Sharing * Industry Partnerships * Response * Incident Handling Plan * Breach Preparation * Tabletop Exercises * Forensic Analysis * Crisis Management * Breach Communications # Legal and Regulatory * Compliance * PCI * SOX * HIPAA * FFIEC, CAT * FERPA * NERC CIP * NIST SP 800-37 and 800-53 * Privacy * Privacy Shield * EU GDPR * Audit * SSAE 16 * SOC 2 * ISO 27001 * FISMA and FedRAMP * NIST SP 800-53A * COSO * Investigations * eDiscovery * Forensics * Intellectual Property Protection * Contract Review * Customer Requirements * Lawsuit Risk # Governance * Strategy * Business Alignment * Risk Management * Program Framework * NIST CSF * ISO 27000 * Control Frameworks * NIST 800-53 * Critical Security * Controls (CSC) * Program Structure * Program Management * Communications Plan * Roles and Responsibilities * Workforce Planning * Resource Management * Data Classification * Security Policy * Creating a Security Culture * Security Training * Awareness Training * Role-Based Training * Metrics and Reporting * IT Portfolio Management * Change Management * Board Communications Building a SOC Security Operations Center * Outsourcing Pros * Potential cost savings – building a SOC is expensive * Fully trained and qualified staff * Experience handling stressful situations * Experience handling all types of security events effectively and efficiently * Augments existing staff/fills gaps in hiring skills professionals * Threat Intelligence – keeps you current on emerging threats * Helps you leverage security intelligence across industries * Industry information sharing * Enables organizations to focus on core tasks * Breaks down barriers in organizations where silos exist * Enables 24x7x365 requirement * Provides SLAs on how service will be provided * Well-defined run book * Outsourcing Cons * Unfamiliar with organization’s business drivers/industry * Limited on depth of service and capabilities * Optimizes its systems to scale and services a large volume of customers * Large customer base, lacks intimate knowledge * Lack of dedicated resources & support for your organization * Focused on maximizing profits * Lack of specialization, excels at providing standard security services vs. customized * Minimal opportunities for correlation unless all data are sent to the MSSP * Outsourced threat intelligence has a short lifespan * No incentive to help improve your operations * Limited ability to store data # MSSP Onboarding Checklist * Organizational Requirements * Defined ownership of security * Good cultural fit * Business partnership * Hiring Standards * Background checks * Credit checks * Security clearance * References * Certifications * Adequately Staffed * Staffing member ratios * Hiring Practices * Drug tests * Citizenship requirements * Suppliers, Partners, and Resellers * Access to customer data * Connection to network * Communication Tools * Case management solution * Information sharing portal * Secure chat * Reports * Metrics and dashboards * Status delivery frequency * MTTD, MTTR * Organizational Stability * Years in business * Financially stable * SLAs and failover capability * Exit strategy *Thanks to Rafeeq Rehman for his mind map*